CVE-2019-5425

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

In Ubiquiti Networks EdgeSwitch X v1.1.0 and prior, an authenticated user can execute arbitrary shell commands over the SSH interface bypassing the CLI interface, which allow them to escalate privileges to root.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Apr 10, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-54264.8In Ubiquiti Networks EdgeSwitch X v1.1.0 and prior, an unauthenticated user can use the "local port forwarding" and "dynamic port forwarding CVE-2019-54277.5c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursi CVE-2019-54297.8Untrusted search path in FileZilla before 3.41.0-rc1 allows an attacker to gain privileges via a malicious 'fzsftp' binary in the user's hom CVE-2019-54308.8In UniFi Video 3.10.0 and prior, due to the lack of CSRF protection, it is possible to abuse the Web API to make changes on the server confi CVE-2019-54315.4This vulnerability was caused by an incomplete fix to CVE-2017-0911. Twitter Kit for iOS versions 3.0 to 3.4.0 is vulnerable to a callback v CVE-2019-54327.5A specifically malformed MQTT Subscribe packet crashes MQTT Brokers using the mqtt-packet module versions < 3.5.1, 4.0.0 - 4.1.3, 5.0.0 - 5.CVE-2019-54335.4A user having access to the UI of a Revive Adserver instance could be tricked into clicking on a specifically crafted admin account-switch.p CVE-2019-54349.8An attacker could send a specifically crafted payload to the XML-RPC invocation script and trigger the unserialize() call on the "what" para CVE-2019-54353.7An integer overflow in curl's URL API results in a buffer overflow in libcurl 7.62.0 to and including 7.64.1.CVE-2019-54367.8A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1.CVE-2019-54375.3Information exposure through the directory listing in npm's harp module allows to access files that are supposed to be ignored according to CVE-2019-54385.3Path traversal using symlink in npm harp module versions <= 0.29.0.